diff --git a/access.lua b/access.lua
index 3dc424e..43ff5ab 100644
--- a/access.lua
+++ b/access.lua
@@ -200,6 +200,9 @@ function authenticate (user, password)
 end
 
 function set_headers (user)
+    if ngx.var.scheme ~= "https" then
+        return redirect("https://"..ngx.var.http_host..ngx.var.uri)
+    end
     user = user or ngx.var.cookie_SSOwAuthUser
     if not cache:get(user.."-password") then
         flash("info", "Please log in to access to this content")